The release on websites this week of what appears to be top-secret computer code that the National Security Agency has used to break into the networks of foreign governments and other espionage targets has caused deep concern inside American intelligence agencies, raising the question of whether Americas own elite operatives have been hacked and their methods revealed.
Most outside experts who examined the posts, by a group calling itself the Shadow Brokers, said they contained what appeared to be genuine samples of the code though somewhat outdated used in the production of the N.S.A.s custom-built malware.
Most of the code was designed to break through network firewalls and get inside the computer systems of competitors like Russia, China and Iran. That, in turn, allows the N.S.A. to place implants in the system, which can lurk unseen for years and be used to monitor network traffic or enable a debilitating computer attack.
-----
But the code does not appear to have come from Mr. Snowdens archive, which was mostly composed of PowerPoint files and other documents that described N.S.A. programs. The documents released by Mr. Snowden and his associates contained no actual source code used to break into the networks of foreign powers.
Whoever obtained the source code apparently broke into either the top-secret, highly compartmentalized computer servers of the N.S.A. or other servers around the world that the agency would have used to store the files. The code that was published on Monday dates to mid-2013, when, after Mr. Snowdens disclosures, the agency shuttered many of its existing servers and moved code to new ones as a security measure.
By midday Tuesday Mr. Snowden himself, in a Twitter message from his exile in Moscow, declared that circumstantial evidence and conventional wisdom indicates Russian responsibility for publication, which he interpreted as a warning shot to the American government in case it was thinking of imposing sanctions against Russia in the cybertheft of documents from the Democratic National Committee.
Why did they do it? Mr. Snowden asked. No one knows, but I suspect this is more diplomacy than intelligence, related to the escalation around the DNC hack.
Around the same time, WikiLeaks declared that it had a full set of the files it did not say how it had obtained them and would release them all in the future. The Shadow Brokers had said they would auction them off to the highest bidder.
----
It certainly feels all real, said Bruce Schneier, a leading authority on state-sponsored breaches. The question is why would someone steal it in 2013 and release it this week? Thats what is making people think this is likely the work of Russian intelligence.
There are other theories, including one that some unknown group was trying to impersonate hackers working for Russian or other intelligence agencies. Impersonation is relatively easy on the internet, and it could take considerable time to determine who is behind the release of the code.
The Shadow Brokers first emerged online on Saturday, creating accounts on sites like Twitter and Tumblr and announcing plans for an auction. The group said that we give you some Equation Group files free and that it would auction the best ones. The Equation Group is a code name that Kaspersky Labs, a Russian cybersecurity firm, has given to the N.S.A.
While still widely considered the most talented group of state-sponsored hackers in the world, the N.S.A. is still recovering from Mr. Snowdens disclosures; it has spent hundreds of millions of dollars reconfiguring and locking down its systems.
Mr. Snowden revealed plans, code names and some operations, including against targets like China. The Shadow Brokers disclosures are much more detailed, the actual code and instructions for breaking into foreign systems as of three summers ago.
From an operational standpoint, this is not a catastrophic leak, Nicholas Weaver, a researcher at the International Computer Science Institute in Berkeley, Calif., wrote on the Lawfare blog on Tuesday.
